Zero Trust Network
Nothing personal. But we don’t trust you.With the worldwide average cost of a data breach sitting at over $5 million NZ, and an average of 25,500 records impacted per incident, it’s actually hard to trust anyone these days.* If you think that’s bad, internet security giant Norton says in their Emerging Threats article that it’s only going to get worse. Gartner says that by 2020, they expect security services to account for 50% of all cybersecurity budgets. And if you experience a breach, it’s certainly not something you can keep secret. The NZ Privacy Act 2020 will make disclosure mandatory. A security breach is not usually anyone’s ‘fault’ (apart from hackers and the rare disgruntled employee). But your business also has a responsibility of care to protect your network and to keep up with best and current practice. By not owning up to that responsibility, you – yes YOU - can easily and unknowingly be the person who leaves the gate open to your valuable data, and the ‘Help Yourself’ sign on the door.
Why the traditional approach to securing your network is no longer enough.While it used to do the job, these days, securing only the perimeter leaves the inner network painfully vulnerable. Why? The threat landscape has changed. All it takes is one employee to plug in a USB drive, click on a phishing email, or reuse a password, and your expensive perimeter firewall is rendered irrelevant – and there’s nothing to stop the attacker moving further through the network. The wide-open spaces of an internal network with no authorisation controls in place provide fertile ground for data theft, ransomware, or worse. Business stakeholders are left holding this risk with no way to influence or manage it – not a comfortable position.
While it may sound brutal, we say trust no-one. And here’s how to do it.As your business stands to lose both reputation and money, the Zero Trust Network security model is the only safe approach to protecting your network. Zero trust is based on the principle of maintaining strict controls as to who can access the network. Without exception. This includes those who are already inside your network perimeter. In fact, zero trust treats accessing the internal network in the same way as accessing the external network by rigorously applying both authentication (who are you?) and authorisation (are you allowed to access this?) at all points. While it may sound draconian, a Zero Trust Network offers substantial business benefits. First, it reduces the risks of data breach within your organisation. It also increases business speed and agility as your network isn’t in constant shutdown mode while breaches are countered. You gain more control over your environment, on-premise and cloud alike, and can focus on the application workload, rather than the security perimeter endpoint. And a ‘no trust’ relationship mean no potential impacts to connected systems when one system changes. A Zero Trust Network makes risk and security compliance audits easier by enabling modern authorisation methods to your backend systems.
Zero Trust Networks with Legacy SystemsZero Trust Networks rely on using modern authentication and authorisation standards to provide the interoperability between all platforms, so how do you achieve this in the real world when you have a mixture of new and legacy systems?
The opinions expressed in our blogs are those of the individual contributors, not necessarily those of Adaptiv Integration. We encourage our people to lead, not follow, and to add value by sharing their experience and unique insights.
Sign up for advance notifications of Adaptiv events.